Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 10:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe
- Size 408KB
- Sample240613-mxfrsszbrk
- SHA256 60294cd12a37aa797db1c788098c9052869f8392b3ba17fd357beac737665e23
- MD5 6dab68798a60327e4d687788f9ba9bc0
- SHA1 a1147f7672980b46102cd3a8eb4e2ab6c16d7dbd
- SHA512 d573dc77247c00e884bc41a22acc0ca7cd355dff6c82666e5a856ed56d27d4ad797ee182526561709558cbed609d422158075b582b69412131c4da0bab8264a3
- SSDEEP 3072:CEGh0odl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGPldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Auto-generated rule 11 IoCs
resource yara_rule behavioral2/files/0x0007000000023259-2.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0007000000023264-6.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0008000000023267-8.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0013000000023264-14.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0009000000023267-18.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x00020000000219e9-22.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070d-26.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000300000000070f-30.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0006000000000026-34.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x0005000000000507-38.dat GoldenEyeRansomware_Dropper_MalformedZoomit behavioral2/files/0x000400000000070d-42.dat GoldenEyeRansomware_Dropper_MalformedZoomit - Modifies Installed Components in the registry 2 TTPs 22 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB} {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C7C2188-9273-48f4-AC78-F518BE15B3DB} {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8C7C2188-9273-48f4-AC78-F518BE15B3DB}\stubpath = "C:\\Windows\\{8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe" {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC} {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B22185B9-321A-4af0-84E4-FCB0073EFD68}\stubpath = "C:\\Windows\\{B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe" 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{342F9753-E564-4ecb-935C-E2DD087D39E0} {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{342F9753-E564-4ecb-935C-E2DD087D39E0}\stubpath = "C:\\Windows\\{342F9753-E564-4ecb-935C-E2DD087D39E0}.exe" {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BBF1216-7C2E-4640-B361-1E2454C8F204} {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD797118-D021-47a9-B563-44EE98B6A801}\stubpath = "C:\\Windows\\{BD797118-D021-47a9-B563-44EE98B6A801}.exe" {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5} {BD797118-D021-47a9-B563-44EE98B6A801}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB}\stubpath = "C:\\Windows\\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe" {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D} {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}\stubpath = "C:\\Windows\\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe" {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}\stubpath = "C:\\Windows\\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe" {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2BBF1216-7C2E-4640-B361-1E2454C8F204}\stubpath = "C:\\Windows\\{2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe" {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BD797118-D021-47a9-B563-44EE98B6A801} {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}\stubpath = "C:\\Windows\\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}.exe" {BD797118-D021-47a9-B563-44EE98B6A801}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{939C4D32-552C-4074-B1C4-8E06B2857A0F} {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA16C5BB-BE57-4503-B989-A91F79886EA3} {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FA16C5BB-BE57-4503-B989-A91F79886EA3}\stubpath = "C:\\Windows\\{FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe" {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B22185B9-321A-4af0-84E4-FCB0073EFD68} 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{939C4D32-552C-4074-B1C4-8E06B2857A0F}\stubpath = "C:\\Windows\\{939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe" {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe - Executes dropped EXE 11 IoCs
pid Process 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 2168 {BD797118-D021-47a9-B563-44EE98B6A801}.exe 964 {0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}.exe - Drops file in Windows directory 11 IoCs
description ioc Process File created C:\Windows\{8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe File created C:\Windows\{FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe File created C:\Windows\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe File created C:\Windows\{BD797118-D021-47a9-B563-44EE98B6A801}.exe {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe File created C:\Windows\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}.exe {BD797118-D021-47a9-B563-44EE98B6A801}.exe File created C:\Windows\{B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe File created C:\Windows\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe File created C:\Windows\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe File created C:\Windows\{2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe File created C:\Windows\{939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe File created C:\Windows\{342F9753-E564-4ecb-935C-E2DD087D39E0}.exe {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe Token: SeIncBasePriorityPrivilege 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe Token: SeIncBasePriorityPrivilege 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe Token: SeIncBasePriorityPrivilege 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe Token: SeIncBasePriorityPrivilege 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe Token: SeIncBasePriorityPrivilege 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe Token: SeIncBasePriorityPrivilege 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe Token: SeIncBasePriorityPrivilege 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe Token: SeIncBasePriorityPrivilege 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe Token: SeIncBasePriorityPrivilege 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe Token: SeIncBasePriorityPrivilege 2168 {BD797118-D021-47a9-B563-44EE98B6A801}.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1588 wrote to memory of 640 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe 97 PID 1588 wrote to memory of 640 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe 97 PID 1588 wrote to memory of 640 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe 97 PID 1588 wrote to memory of 4944 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe 98 PID 1588 wrote to memory of 4944 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe 98 PID 1588 wrote to memory of 4944 1588 2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe 98 PID 640 wrote to memory of 400 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 102 PID 640 wrote to memory of 400 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 102 PID 640 wrote to memory of 400 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 102 PID 640 wrote to memory of 2580 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 103 PID 640 wrote to memory of 2580 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 103 PID 640 wrote to memory of 2580 640 {B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe 103 PID 400 wrote to memory of 3564 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 104 PID 400 wrote to memory of 3564 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 104 PID 400 wrote to memory of 3564 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 104 PID 400 wrote to memory of 964 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 105 PID 400 wrote to memory of 964 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 105 PID 400 wrote to memory of 964 400 {939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe 105 PID 3564 wrote to memory of 4956 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 107 PID 3564 wrote to memory of 4956 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 107 PID 3564 wrote to memory of 4956 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 107 PID 3564 wrote to memory of 4612 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 108 PID 3564 wrote to memory of 4612 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 108 PID 3564 wrote to memory of 4612 3564 {342F9753-E564-4ecb-935C-E2DD087D39E0}.exe 108 PID 4956 wrote to memory of 4080 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 109 PID 4956 wrote to memory of 4080 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 109 PID 4956 wrote to memory of 4080 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 109 PID 4956 wrote to memory of 4132 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 110 PID 4956 wrote to memory of 4132 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 110 PID 4956 wrote to memory of 4132 4956 {3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe 110 PID 4080 wrote to memory of 4872 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 111 PID 4080 wrote to memory of 4872 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 111 PID 4080 wrote to memory of 4872 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 111 PID 4080 wrote to memory of 4044 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 112 PID 4080 wrote to memory of 4044 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 112 PID 4080 wrote to memory of 4044 4080 {8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe 112 PID 4872 wrote to memory of 2136 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 113 PID 4872 wrote to memory of 2136 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 113 PID 4872 wrote to memory of 2136 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 113 PID 4872 wrote to memory of 3808 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 114 PID 4872 wrote to memory of 3808 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 114 PID 4872 wrote to memory of 3808 4872 {FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe 114 PID 2136 wrote to memory of 2728 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 115 PID 2136 wrote to memory of 2728 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 115 PID 2136 wrote to memory of 2728 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 115 PID 2136 wrote to memory of 2300 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 116 PID 2136 wrote to memory of 2300 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 116 PID 2136 wrote to memory of 2300 2136 {F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe 116 PID 2728 wrote to memory of 2672 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 117 PID 2728 wrote to memory of 2672 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 117 PID 2728 wrote to memory of 2672 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 117 PID 2728 wrote to memory of 1684 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 118 PID 2728 wrote to memory of 1684 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 118 PID 2728 wrote to memory of 1684 2728 {5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe 118 PID 2672 wrote to memory of 2168 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 119 PID 2672 wrote to memory of 2168 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 119 PID 2672 wrote to memory of 2168 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 119 PID 2672 wrote to memory of 1752 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 120 PID 2672 wrote to memory of 1752 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 120 PID 2672 wrote to memory of 1752 2672 {2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe 120 PID 2168 wrote to memory of 964 2168 {BD797118-D021-47a9-B563-44EE98B6A801}.exe 121 PID 2168 wrote to memory of 964 2168 {BD797118-D021-47a9-B563-44EE98B6A801}.exe 121 PID 2168 wrote to memory of 964 2168 {BD797118-D021-47a9-B563-44EE98B6A801}.exe 121 PID 2168 wrote to memory of 2460 2168 {BD797118-D021-47a9-B563-44EE98B6A801}.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_6dab68798a60327e4d687788f9ba9bc0_goldeneye.exe"1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Windows\{B22185B9-321A-4af0-84E4-FCB0073EFD68}.exeC:\Windows\{B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe2⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\{939C4D32-552C-4074-B1C4-8E06B2857A0F}.exeC:\Windows\{939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\{342F9753-E564-4ecb-935C-E2DD087D39E0}.exeC:\Windows\{342F9753-E564-4ecb-935C-E2DD087D39E0}.exe4⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Windows\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exeC:\Windows\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe5⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Windows\{8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exeC:\Windows\{8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe6⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\{FA16C5BB-BE57-4503-B989-A91F79886EA3}.exeC:\Windows\{FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe7⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exeC:\Windows\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe8⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Windows\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exeC:\Windows\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe9⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\{2BBF1216-7C2E-4640-B361-1E2454C8F204}.exeC:\Windows\{2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe10⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\{BD797118-D021-47a9-B563-44EE98B6A801}.exeC:\Windows\{BD797118-D021-47a9-B563-44EE98B6A801}.exe11⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}.exeC:\Windows\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}.exe12⤵
- Executes dropped EXE
PID:964
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{BD797~1.EXE > nul12⤵PID:2460
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{2BBF1~1.EXE > nul11⤵PID:1752
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{5D0D2~1.EXE > nul10⤵PID:1684
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{F08BF~1.EXE > nul9⤵PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{FA16C~1.EXE > nul8⤵PID:3808
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{8C7C2~1.EXE > nul7⤵PID:4044
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{3BD21~1.EXE > nul6⤵PID:4132
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{342F9~1.EXE > nul5⤵PID:4612
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{939C4~1.EXE > nul4⤵PID:964
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\{B2218~1.EXE > nul3⤵PID:2580
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul2⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2824 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:81⤵PID:4456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\{0E6D55D9-D2D0-4b77-A25A-743B8C3091D5}.exe
- Size 408KB
- SHA256 c2b2ff57f88a81d759a06f96aec3077165820abaae8c4d2f1d5471b3d8b208ea
- MD5 4a3c90fd94f5d8b107aa36260687530c
- SHA1 b17b1e012dffd13d712d335c42293fd821a4f882
- SHA512 8d352c398a2cfcbbd9664901db26e229103cdbc0f6fea1aa61bc0bc6210f7d6fb9f4ba64461228ed59562fe43b30f1881886d4a1ac071409bb8c83c16c05c8c0
- SSDEEP 3072:CEGh0o6l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGcldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{2BBF1216-7C2E-4640-B361-1E2454C8F204}.exe
- Size 408KB
- SHA256 e7cc44e7c9d70ca7593a75a532f50161b406e262538930cc51713cc044a14080
- MD5 bf50eb1652149c83829a3f68b0b6319c
- SHA1 35cc2b605ca4a2f3e6db6a77402dca9fca3f34b4
- SHA512 e848d8878123ccf2b696f8ebebb325fbd3f973b9808f4bea7fd8bf7e76ffecddafdece6b7f91089a52fa2321311d32424420f382d5013b464b527a7aef623566
- SSDEEP 3072:CEGh0obl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGFldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{342F9753-E564-4ecb-935C-E2DD087D39E0}.exe
- Size 408KB
- SHA256 bbb8db153aa6fc24bffa6f6aa1c291a4cb92e12281a11a5e524144f0978861ec
- MD5 88d6d8468737c1ffd1216f8d3af48120
- SHA1 2ec5c516076204557852513d3eb7c462b70eb30d
- SHA512 ee716bdf94c0819b6814aa948775a34809c82ff70e515c2e8be275fc4404a65b990ef7a21185fb8e51ba4a9144826245d31ceb0a26e1d08f2e504c945595fa3d
- SSDEEP 3072:CEGh0oKl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{3BD21DC9-1EC8-45d3-A390-A239F7D077CB}.exe
- Size 408KB
- SHA256 9737e0e38cdf51c23e75131dde370ea3840d9e631c2553074d92868f5bd78bea
- MD5 d876dd436b6ff1196f672607f074a150
- SHA1 a0f79051d759a2e5b8bdc54cb3d8c5d131f975b6
- SHA512 48a22c5a09344e87f3a11255c1caf4229fa974be5c7bd62969d1226805a0b0607b390022e3860e4c8ef2044970187e5a6446beb3d8d7670ebeac075592f3d6d2
- SSDEEP 3072:CEGh0o7l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{5D0D2E4C-9401-454d-BBB5-2F8DE218CFEC}.exe
- Size 408KB
- SHA256 512e1bdcbed5837e5945a9667b679a02c3dbdf85d3cb9db4166784db6d99b494
- MD5 e32accaa4b7f284dd88cd29fd4a9c787
- SHA1 f24a784d4b46c96a5576ccad59044e033947e2c8
- SHA512 aee0bc27fd9415d31233d75e99d2161f37f7275e56ce1d2ddeb3ab5c31acd2c2e9bfdfe577fb3d8b7ff9778c00a767af7b321d29e8532cbb11e370458ab25c7f
- SSDEEP 3072:CEGh0oCl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGEldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{8C7C2188-9273-48f4-AC78-F518BE15B3DB}.exe
- Size 408KB
- SHA256 11188c234a7521c0bacd99eafd95260e680e944a5ab6690bc0ec216049bffa17
- MD5 4f12be769ce2f2f7361cd3a5b6a7549e
- SHA1 4feb27de6f9633000521bc4f91410a58f19d7fbc
- SHA512 1206ec73b3e6a07602bd31cb268f295196aa06ab93e38eef80f8069e530c443f0bde68e4604ba076c0a229c7e69995e28dcca3236e54bea3eae3c76bc63af088
- SSDEEP 3072:CEGh0oal3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG0ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{939C4D32-552C-4074-B1C4-8E06B2857A0F}.exe
- Size 408KB
- SHA256 6b8a025357188384420be907f86e3c9d9b89a5a9c08a9ec054c51db35360f5c2
- MD5 5c8c38ef10101e4977b090ab44655628
- SHA1 ab0d19c9d0fbecbd83d688fd29cee4db76a86c2d
- SHA512 a7bbbec68b0bf15b5a74829124e9ea9f419c34dfc5d205c0afadfb2fa231bc6a3c78f288aa5d6aac1f2bbe04fa7fa9c2135d9cf4852f3c1a5b1a8455c6ebf202
- SSDEEP 3072:CEGh0oXl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGVldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{B22185B9-321A-4af0-84E4-FCB0073EFD68}.exe
- Size 408KB
- SHA256 285c4a815fcac34ddb84397dbb1e775df979b18e8cfacf105da76928609a6842
- MD5 529155467d6fa9d3c6171a5bdf4743d5
- SHA1 157ad7379f1f92ab93ace42d3e2f1e98af85ec7a
- SHA512 4af853634922cc4a808c0d12f51df42fd4e75e92b10685c22ae3327af6aa01dd846d5c28c889f9b328a7ba59390548a5d08dbb3dcdf22d41b79aee5752157413
- SSDEEP 3072:CEGh0oml3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEG8ldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{BD797118-D021-47a9-B563-44EE98B6A801}.exe
- Size 408KB
- SHA256 037c168c6ad9a01445effe3bb5dc874b0f9a9e5da1494bdfe67f4a38eba43669
- MD5 a7ec1693529221466dc0a07d00562312
- SHA1 0ff84a3df87c59c63dbfe17c356dd00bbb11f403
- SHA512 e33dbca6a603cf18cdad86168599411f58032ea44fd0b27b553a43bc98d3e9a58186cecd5a8b7f7641feeb04c1e3258b9d11c66c00ef9dffc7ce3f2ca754af4b
- SSDEEP 3072:CEGh0oul3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGkldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{F08BFD90-328B-4be6-96B0-2BBAE7D7E63D}.exe
- Size 408KB
- SHA256 d32cf5f29a4630e1b879eafab049d8a6ed88754441547fe80d1f53af57289e9a
- MD5 ade7b660c7086c6f049edd174c7ecbbc
- SHA1 1771abcf8237768b983fceacdde1455611613a92
- SHA512 fcf1b88cdeb1d97373f00e91d8bbcccc67e142d5069ab81bfb6209253d24157e2f162cac4e99f389e9e0c83b2ac71d453e4cf36893316a7876361e8557dd3551
- SSDEEP 3072:CEGh0o+l3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGwldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\{FA16C5BB-BE57-4503-B989-A91F79886EA3}.exe
- Size 408KB
- SHA256 66e16451b61605f3732f55d67dd5a6c04f74b56824ebcb9a31130a57af151cf3
- MD5 ca34220bf39be86b45b637e9dcbcbeaf
- SHA1 6560e9b28e89e50c757babac6ac6ed60cfaef880
- SHA512 e12305af7e91b453c16eda5c22c331ef1f0df68dfad3363e5dc4900d1701f6fe418d9d871bda0c016b56ca9689da8b6c231c957115e20c8f91f84c9284b62533
- SSDEEP 3072:CEGh0otl3OiNOe2MUVg3bHrH/HqOYGte+rcC4F0fJGRIS8Rfd7eQEcGcrTutTBf3:CEGfldOe2MUVg3vTeKcAEciTBqr3jy
- MD5 SHA1 SHA512 SSDEEP